I’m wondering if it isn’t better to just whitelist cookies for the sites I need to log into and not bother with a password manager extension (keepasxc or bitwarden). I try to keep the number of extensions in my browser to a minimum to lower the attack surface. And why involve one more entity in the password story? Are there any problems with using the (1st party) cookies of sites I have signed up to and use to keep me signed in?
No. Your desktop password manager is encrypted with a strong passphrase that locks when you’re computer locks. (Right?) They’d have to snatch your gear mid-session. Cookies are not safe, and cookie hijacks are a pretty common exploit. Cookies are for convenience, not security. Retaining authentication cookies is a very big security hole that we all do, and it’s why banks don’t let you re-auth on a previous session cookie.
“Pretty hard to break into” is the kind of phrase that keeps infosec people up at night. It’s the kind of phrase that reads to me as “full of vulnerabilities so I can easily break in.” You probably want to read up on your security practices.
Yes. First party cookies can be just as nefarious in addition to the technical requirements. Cookie managers are more relaxed about first party because we assume you’re on that site for a reason, not because the cookies aren’t a risk.
3a. Never assume that something supposed to be “mostly benign” isn’t currently being exploited for bad reasons.
To your OP, It’s actually not a terrible idea to uninstall the PW manager browser extension. It’s one more layer of isolation from the browser. You just lose the convenience of autofill.
But definitely rely on the PW manager for session security and not cookies.
Edit: a couple edits.
Thanks, I will be deleting all cookies and using my desktop keepassxc.